A risk manager walks into a meeting with a one-page report. The number at the top says: 99% 1-day VaR = $2.4 million. The CFO nods — that's within limits. Three weeks later, a rate decision triggers a gap move in a currency pair nobody was watching, and the desk loses $11 million in a day. The report wasn't wrong. It answered a different question than the one everyone assumed it answered. That gap between what a VaR number says and what people hear is the whole game. If you work with risk reports — as an analyst, auditor, PM, or founder — this breakdown is for you. You'll see how VaR is actually computed, where it fails, how Expected Shortfall and stress testing patch those holes, and how Basel III/IV FRTB redrew the rules. By the end you'll be able to read a risk report and quiz a risk team without being a quant.
How VaR is actually computed (and why three methods give three numbers)
Value at risk answers a narrow question: over a given horizon, with a given confidence level, what loss will not be exceeded? The 99% 1-day VaR of $2.4 million means: on 99 days out of 100, the loss should stay under $2.4 million. It says nothing about the one day it doesn't.
There are three standard ways to get that number, and they disagree — sometimes by a factor of two.
- Historical simulation. Take the last 500 trading days of actual returns for each position, revalue the portfolio under each day's returns, sort the results, and read off the 5th worst day (for 99% with 500 observations). No distribution assumptions. But the answer is only as good as the window: if the last 500 days were calm, your VaR is calm. It also can't produce a loss larger than the worst day in the window — a structural blind spot.
- Variance-covariance (parametric). Assume returns are normal, estimate the covariance matrix, and compute the portfolio standard deviation. VaR = z × σ × √horizon, where z is 2.33 for 99%. Fast, clean, scales to thousands of positions. The price is the normality assumption — and markets are not normal. The same assumption also makes the math treat a portfolio of options as if it were linear, which it isn't.
- Monte Carlo. Simulate thousands of scenarios from a chosen model, revalue the full portfolio under each, and take the percentile. Handles non-linear instruments (options, structured products) and complex path dependencies. The cost is model risk: the simulation is only as good as the distribution and correlation assumptions you fed it, and it's computationally heavy.
For a portfolio of plain equities, all three often land within 10–20% of each other. Add options, illiquid credit, or a concentrated position, and the spread widens. A common mistake is to treat the lowest of the three numbers as the "true" one — that's not conservatism, that's picking the model that flatters you.
What the 99%/1-day number does not capture
The number is a quantile, not a loss estimate. It tells you where the tail starts, not how deep the tail goes. That distinction is where most misreadings begin.
Fat tails. Normal distributions assign vanishingly small probability to 5-sigma moves. In real markets, 5-sigma days happen more often than the Gaussian model predicts. A VaR computed under normality systematically understates the frequency of extreme losses.
Non-stationarity. Volatility clusters. A VaR calibrated on a low-vol window will be too low precisely when markets turn. Many banks use exponentially weighted volatility to react faster, but that's a trade-off: shorter memory means noisier estimates and more false alarms.
Correlation breakdown. In a crisis, correlations that looked stable go to one. Diversification that worked in calm markets evaporates exactly when you need it. A parametric VaR built on a pre-crisis covariance matrix will understate portfolio risk because it assumes the diversification still holds.
Liquidity and horizon mismatch. A 1-day VaR assumes you can exit at the marked price. For a position that takes a week to unwind, the 1-day number is not the right horizon — and the loss from trying to exit fast is not in the model.
Expected Shortfall and stress testing: patching the tail
Expected Shortfall (ES) — also called CVaR — answers the question VaR dodges: given that you're in the worst 1% of days, what's the average loss? For a normal distribution, 97.5% ES is roughly equal to 99% VaR, which is why Basel's shift to ES at 97.5% was designed to keep capital roughly comparable while capturing tail severity.
ES is subadditive — the ES of a combined portfolio is never worse than the sum of the parts — which VaR is not. That matters for risk aggregation across desks. The trade-off: ES is harder to backtest. You can count VaR exceedances; you can't easily validate an average of tail losses that rarely occur.
Stress testing covers what both VaR and ES miss: scenarios that haven't happened in the sample window. A stress test asks: what if rates move 200bp in a day, or a currency peg breaks, or a counterparty defaults while funding markets seize? Reverse stress testing goes further: start from the loss that would sink the firm and work backwards to the scenario that produces it. That's uncomfortable — which is why it's useful.
Basel III/IV and FRTB changed the framing in two ways. First, the internal models approach moved from 99% VaR to 97.5% ES, acknowledging the tail-severity problem. Second, FRTB added a standardized approach and a trading-desk-level approval process, so a bank can't hide a weak desk inside a strong firm-wide model. The practical effect: more capital sensitivity to liquidity horizon and model risk, and less room for internal models that flatter the numbers.
Reading a risk report without being a quant
You don't need to rebuild the covariance matrix to ask good questions. You need to know which knobs were turned.
| What to ask | What it reveals |
|---|---|
| Which method produced this VaR? | Whether the number is parametric (normality assumed) or historical (window-dependent). |
| What's the lookback window and weighting? | Whether the bank is slow or fast to react to vol changes. |
| What's the ES at 97.5%? | The severity of the tail, not just its edge. |
| What stress scenarios were run? | Whether the firm tested for correlation breakdown, liquidity holes, and reverse stress. |
| How many VaR breaches last year? | Backtesting quality — a model with too many breaches is either wrong or too conservative. |
| How does FRTB capital compare to the old number? | Whether the desk is being penalized for model risk or liquidity horizon. |
The biggest red flag is a risk report that shows only one number and no exceedance history. A second red flag: stress scenarios that are all "moderate recession" variants. If none of them are embarrassing, they weren't designed to be useful.
Learning paths: self-study vs structured practice
The math is learnable on your own — probability, covariance matrices, Monte Carlo, the Basel texts are public. But three things are hard to get without a structured path: feedback on your calculations, a sense of which assumptions matter in practice, and exposure to the regulatory framing that exam questions and real risk committees both use.
Self-study works if you already have a quant background and just need the regulatory vocabulary. It's cheap but slow, and you can spend weeks on a topic that turns out to be a minor exam point. A structured course compresses that: it walks through the actual computation of VaR under all three methods, shows where each breaks, and gives you practice questions that mirror the exam's framing. The trade-off is cost and fixed pace — you lose the freedom to skip what you already know. For a deeper dive into this topic, see SEO and Website Promotion.
The FRM — Financial Risk Manager (Part I + Part II) course on asibiont covers exactly this territory: quantitative methods, market and credit risk, operational risk, stress testing and Basel III/IV, with mock exams and a large question bank. It's one path, not the only one — but it closes the feedback gap that self-study leaves open.
Who this suits — and who it doesn't
This material suits analysts moving from reporting to risk ownership, auditors who need to challenge model outputs, and PMs who want to understand why a "safe" portfolio can blow up. It does not suit someone looking for a shortcut to a trading desk — VaR is a risk tool, not an alpha signal. And it won't make you a quant in a month; the math is real, and the regulatory detail is dense.
If you've ever stared at a risk report and wondered whether the number was meaningful or just well-formatted, the next step is to learn how it's built. The FRM — Financial Risk Manager (Part I + Part II) course walks through the computations with examples and gives you practice on the questions that reveal whether you actually understand the assumptions. Start there, and the next risk report you read will look different — not because the number changed, but because you'll know what it's hiding. For a deeper dive into this topic, see Project Management.